# raahulpatel07/malwaredetection architecture

> Architecture diagram of the GitHub repository raahulpatel07/malwaredetection, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/raahulpatel07/malwaredetection
- Repository: https://github.com/raahulpatel07/malwaredetection

## Overview

This is a Windows-focused malware detection application. Its main workflow is file arrival or modification → filtering and static analysis → calibrated ML detection for PE files (with heuristic scoring for other types) → verdict, quarantine when suspicious or malicious, notification, and scan-history logging. The Flask dashboard provides manual scans and scan/quarantine history and actions; model training and calibration support the detection layer. Some monitor and dashboard wiring is inferred from the README because the relevant source excerpts are incomplete.

Main entry points: [`src/realtime_monitor.py`](https://github.com/raahulpatel07/malwaredetection/blob/main/src/realtime_monitor.py) (Realtime Monitor), [`dashboard/app.py`](https://github.com/raahulpatel07/malwaredetection/blob/main/dashboard/app.py) (Dashboard API), [`src/hybrid_model.py`](https://github.com/raahulpatel07/malwaredetection/blob/main/src/hybrid_model.py) (Hybrid Ensemble), [`src/train_hybrid.py`](https://github.com/raahulpatel07/malwaredetection/blob/main/src/train_hybrid.py) (Model Training)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_monitoring["Monitoring and Scanning"]
  node_monitor["Realtime Monitor"]
end

subgraph group_detection["Detection Engine"]
  node_analyzer["Static Analyzer<br/>[file_analyzer.py]"]
  node_detector["ML Detector<br/>[ml_detector.py]"]
  node_ensemble["Hybrid Ensemble<br/>[hybrid_model.py]"]
  node_model_files["Model and Calibration"]
end

subgraph group_response["Response and Records"]
  node_quarantine["Quarantine Manager<br/>[quarantine.py]"]
  node_notifications["Desktop Notifications"]
  node_scan_history[("Scan History<br/>[config.py]")]
  node_restore_exemptions[("Restore Exemptions")]
end

subgraph group_dashboard["Dashboard"]
  node_dashboard_app["Dashboard API<br/>[app.py]"]
  node_dashboard_ui["Dashboard UI"]
  node_dashboard_js["Dashboard Actions<br/>[script.js]"]
end

subgraph group_model_ops["Model Preparation"]
  node_training["Model Training<br/>[train_hybrid.py]"]
  node_calibration["Model Calibration"]
end

node_user(("User"))
node_watched_files["Watched Files"]
node_dashboard_user(("Dashboard User"))
node_ember_data[("EMBER Dataset")]
node_model_store[("Trained Model")]

node_watched_files -->|"trigger events"| node_monitor
node_monitor -->|"analyze files"| node_analyzer
node_monitor -->|"score PE files"| node_detector
node_detector -->|"score features"| node_ensemble
node_detector -->|"read calibration"| node_model_files
node_ensemble -->|"load model"| node_model_files
node_monitor -->|"quarantine flagged"| node_quarantine
node_monitor -->|"write scan results"| node_scan_history
node_monitor -.->|"notify verdict"| node_notifications
node_monitor -->|"check exemptions"| node_restore_exemptions
node_dashboard_user -->|"use dashboard"| node_dashboard_ui
node_dashboard_ui -->|"load actions"| node_dashboard_js
node_dashboard_js -->|"request actions"| node_dashboard_app
node_dashboard_app -->|"read and write"| node_scan_history
node_dashboard_app -->|"manage files"| node_quarantine
node_dashboard_app -->|"record restore"| node_restore_exemptions
node_dashboard_app -.->|"run manual scan"| node_analyzer
node_training -->|"read samples"| node_ember_data
node_training -->|"fit model"| node_ensemble
node_training -->|"save model"| node_model_store
node_calibration -->|"read samples"| node_ember_data
node_calibration -->|"score samples"| node_ensemble
node_calibration -->|"write calibration"| node_model_files

click node_monitor "https://github.com/raahulpatel07/malwaredetection/blob/main/src/realtime_monitor.py"
click node_analyzer "https://github.com/raahulpatel07/malwaredetection/blob/main/src/file_analyzer.py"
click node_detector "https://github.com/raahulpatel07/malwaredetection/blob/main/src/ml_detector.py"
click node_ensemble "https://github.com/raahulpatel07/malwaredetection/blob/main/src/hybrid_model.py"
click node_model_files "https://github.com/raahulpatel07/malwaredetection/blob/main/model/hybrid_calibration.json"
click node_quarantine "https://github.com/raahulpatel07/malwaredetection/blob/main/src/quarantine.py"
click node_scan_history "https://github.com/raahulpatel07/malwaredetection/blob/main/src/config.py"
click node_restore_exemptions "https://github.com/raahulpatel07/malwaredetection/blob/main/src/restore_exclusions.py"
click node_dashboard_app "https://github.com/raahulpatel07/malwaredetection/blob/main/dashboard/app.py"
click node_dashboard_ui "https://github.com/raahulpatel07/malwaredetection/tree/main/dashboard/templates"
click node_dashboard_js "https://github.com/raahulpatel07/malwaredetection/blob/main/dashboard/static/js/script.js"
click node_training "https://github.com/raahulpatel07/malwaredetection/blob/main/src/train_hybrid.py"
click node_calibration "https://github.com/raahulpatel07/malwaredetection/blob/main/src/calibrate_hybrid.py"
click node_model_store "https://github.com/raahulpatel07/malwaredetection/tree/main/model"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_monitor,node_user,node_dashboard_user toneBlue
class node_analyzer,node_detector,node_ensemble,node_model_files,node_ember_data,node_model_store toneAmber
class node_quarantine,node_notifications,node_scan_history,node_restore_exemptions toneMint
class node_dashboard_app,node_dashboard_ui,node_dashboard_js toneRose
class node_training,node_calibration,node_watched_files toneIndigo
```

## Components

### Monitoring and Scanning

- [Realtime Monitor](https://github.com/raahulpatel07/malwaredetection/blob/main/src/realtime_monitor.py): `src/realtime_monitor.py`

### Detection Engine

- [Static Analyzer](https://github.com/raahulpatel07/malwaredetection/blob/main/src/file_analyzer.py): `src/file_analyzer.py`
- [ML Detector](https://github.com/raahulpatel07/malwaredetection/blob/main/src/ml_detector.py): `src/ml_detector.py`
- [Hybrid Ensemble](https://github.com/raahulpatel07/malwaredetection/blob/main/src/hybrid_model.py): `src/hybrid_model.py`
- [Model and Calibration](https://github.com/raahulpatel07/malwaredetection/blob/main/model/hybrid_calibration.json): `model/hybrid_calibration.json`

### Response and Records

- [Quarantine Manager](https://github.com/raahulpatel07/malwaredetection/blob/main/src/quarantine.py): `src/quarantine.py`
- **Desktop Notifications**
- [Scan History](https://github.com/raahulpatel07/malwaredetection/blob/main/src/config.py): `src/config.py`
- [Restore Exemptions](https://github.com/raahulpatel07/malwaredetection/blob/main/src/restore_exclusions.py): `src/restore_exclusions.py`

### Dashboard

- [Dashboard API](https://github.com/raahulpatel07/malwaredetection/blob/main/dashboard/app.py): `dashboard/app.py`
- [Dashboard UI](https://github.com/raahulpatel07/malwaredetection/tree/main/dashboard/templates): `dashboard/templates`
- [Dashboard Actions](https://github.com/raahulpatel07/malwaredetection/blob/main/dashboard/static/js/script.js): `dashboard/static/js/script.js`

### Model Preparation

- [Model Training](https://github.com/raahulpatel07/malwaredetection/blob/main/src/train_hybrid.py): `src/train_hybrid.py`
- [Model Calibration](https://github.com/raahulpatel07/malwaredetection/blob/main/src/calibrate_hybrid.py): `src/calibrate_hybrid.py`

### Other components

- **User**
- **Watched Files**
- **Dashboard User**
- **EMBER Dataset**
- [Trained Model](https://github.com/raahulpatel07/malwaredetection/tree/main/model): `model`

## Connections

- Watched Files → Realtime Monitor: trigger events
- Realtime Monitor → Static Analyzer: analyze files
- Realtime Monitor → ML Detector: score PE files
- ML Detector → Hybrid Ensemble: score features
- ML Detector → Model and Calibration: read calibration
- Hybrid Ensemble → Model and Calibration: load model
- Realtime Monitor → Quarantine Manager: quarantine flagged
- Realtime Monitor → Scan History: write scan results
- Realtime Monitor → Desktop Notifications: notify verdict
- Realtime Monitor → Restore Exemptions: check exemptions
- Dashboard User → Dashboard UI: use dashboard
- Dashboard UI → Dashboard Actions: load actions
- Dashboard Actions → Dashboard API: request actions
- Dashboard API → Scan History: read and write
- Dashboard API → Quarantine Manager: manage files
- Dashboard API → Restore Exemptions: record restore
- Dashboard API → Static Analyzer: run manual scan
- Model Training → EMBER Dataset: read samples
- Model Training → Hybrid Ensemble: fit model
- Model Training → Trained Model: save model
- Model Calibration → EMBER Dataset: read samples
- Model Calibration → Hybrid Ensemble: score samples
- Model Calibration → Model and Calibration: write calibration